CVE-2026-34426: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-34426 is an approval bypass vulnerability in OpenClaw (npm package) caused by inconsistent environment variable normalization between the approval and execution code paths. Affecting all versions up to and including 2026.4.1, the flaw allows low-privileged network attackers to inject attacker-controlled environment variables into command execution without those variables being reviewed or validated by the approval system. The vulnerability was disclosed on April 2, 2026, and patched in version 2026.4.2 (commit b57b680). It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs) and relates to improper handling of case/character sensitivity (CWE-178). The approval binding path in system-run-approval-binding.ts used normalizeEnvVarKey(rawKey, { portable: true }), which applies the regex PORTABLE_ENV_VAR_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/ and silently discards Windows-compatible keys containing parentheses (e.g., ProgramFiles(x86)). The execution path, however, used normalizeHostOverrideEnvVarKey, which accepts the broader WINDOWS_COMPAT_OVERRIDE_ENV_VAR_KEY = /^[A-Za-z_][A-Za-z0-9_()]*$/ pattern. This divergence caused Windows-compatible keys to produce envHash = null during approval, so a different (attacker-supplied) value for the same key would also produce envHash = null at execution time — a classic fail-open condition where null == null passes the match check without detecting the substitution (GitHub PR #59182, GitHub Advisory).

Successful exploitation allows a low-privileged attacker to inject arbitrary environment variable values into approved command executions without operator awareness, bypassing the integrity guarantee of the approval system. The primary impact is high integrity loss: attacker-controlled environment variables (such as PATH, ProgramFiles(x86), or similar) can redirect execution to attacker-controlled binaries, enabling unauthorized code execution within the context of the OpenClaw host process. Confidentiality is also partially impacted, as injected environment variables could expose sensitive runtime data or credentials accessible to the process (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039%, indicating a low probability of near-term exploitation. Exploitation requires low privileges (an authenticated user account) and active user interaction (an operator must approve the command), which limits the attack surface compared to fully unauthenticated vulnerabilities (GitHub Advisory).

1. Obtain low-privileged access: Acquire a low-privileged account on an OpenClaw instance running version ≤ 2026.4.1 with the system.run (host-exec) feature enabled.
2. Craft a malicious command request: Submit a system.run command request that includes a Windows-compatible environment variable key (e.g., ProgramFiles(x86)) with a benign-looking value (e.g., C:\Program Files (x86)) in the env override payload.
3. Trigger operator approval: The approval system processes the env override keys using the portable-only normalization, silently dropping the ProgramFiles(x86) key. The resulting envHash is null, and the operator approves the command without seeing the env override in the binding.
4. Substitute the malicious value at execution: At execution time, resubmit or manipulate the request so that ProgramFiles(x86) maps to an attacker-controlled path (e.g., D:\malicious). The execution path accepts this key and injects the malicious value into the process environment.
5. Achieve code execution: Because envHash = null matches envHash = null, the approval check passes. The command runs with the attacker-supplied environment variable, potentially redirecting binary resolution to an attacker-controlled location and executing arbitrary code (GitHub PR #59182, GitHub Advisory).

• Logs: OpenClaw execution logs showing system.run commands with environment variable keys containing parentheses (e.g., ProgramFiles(x86)) that are absent from the corresponding approval binding record; approval records where envHash is null but the executed command included env overrides.
• Process: Unexpected processes spawned by the OpenClaw host process from non-standard binary paths (e.g., paths under user-writable directories rather than standard system directories); processes whose parent is the OpenClaw Node.js runtime but whose binary path does not match expected system locations.
• File System: Presence of attacker-controlled binaries placed in directories referenced by Windows-compatible environment variables (e.g., ProgramFiles(x86), PATH entries) that differ from system defaults.

Upgrade OpenClaw (npm) to version 2026.4.2 or later, which aligns the approval binding normalization with the execution path by replacing normalizeEnvVarKey(rawKey, { portable: true }) with normalizeHostOverrideEnvVarKey in system-run-approval-binding.ts. The fix also adds a fail-closed guard in matchSystemRunApprovalEnvHash that returns APPROVAL_ENV_BINDING_MISSING when both hashes are null but actual env keys are present, preventing silent bypass due to future normalization drift. Organizations unable to upgrade immediately should restrict access to the system.run / host-exec feature to fully trusted users and monitor approval logs for env overrides with Windows-compatible key names (GitHub Advisory, GitHub PR #59182, Fix Commit).

The vulnerability was reported by researcher @iskindar and coordinated by @wsparks-vc (VulnCheck), who is credited in the official GitHub Security Advisory (GitHub Advisory). VulnCheck published a dedicated advisory for the issue. The fix was reviewed by automated tooling (Greptile) which rated the PR 5/5 confidence and confirmed the change as strictly more restrictive with no legitimate bypasses removed (GitHub PR #59182). Community reaction has been limited, consistent with the low EPSS score and absence of active exploitation.